k
63 lines
2.0 KiB
Python
63 lines
2.0 KiB
Python
"""
|
|
Envelope encryption for HL API private keys.
|
|
|
|
Plaintext keys never touch disk: stored values are Fernet-encrypted with a KEK
|
|
loaded from env (ENCRYPTION_KEY). Rotate KEK → re-encrypt all keys offline.
|
|
"""
|
|
import base64
|
|
import hashlib
|
|
import logging
|
|
from typing import Optional
|
|
|
|
from cryptography.fernet import Fernet, InvalidToken
|
|
|
|
from app.config import settings
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
def _derive_fernet_key(raw: str) -> bytes:
|
|
"""Accept any reasonably-long secret and derive a valid 32-byte Fernet key."""
|
|
if not raw or len(raw) < 32:
|
|
raise RuntimeError(
|
|
"ENCRYPTION_KEY must be set to at least 32 random chars (e.g. `openssl rand -hex 32`)"
|
|
)
|
|
digest = hashlib.sha256(raw.encode("utf-8")).digest()
|
|
return base64.urlsafe_b64encode(digest)
|
|
|
|
|
|
_fernet: Optional[Fernet] = None
|
|
|
|
|
|
def _cipher() -> Fernet:
|
|
global _fernet
|
|
if _fernet is None:
|
|
_fernet = Fernet(_derive_fernet_key(settings.encryption_key))
|
|
return _fernet
|
|
|
|
|
|
# Prefix lets us distinguish encrypted blobs from any legacy plaintext rows during migration
|
|
ENC_PREFIX = "enc:v1:"
|
|
|
|
|
|
def encrypt_api_key(plaintext: str) -> str:
|
|
token = _cipher().encrypt(plaintext.encode("utf-8")).decode("utf-8")
|
|
return ENC_PREFIX + token
|
|
|
|
|
|
def decrypt_api_key(stored: str) -> str:
|
|
if not stored:
|
|
raise ValueError("Empty api key")
|
|
if not stored.startswith(ENC_PREFIX):
|
|
# Legacy plaintext row (from before encryption was added). Refuse to use in prod.
|
|
if settings.environment == "production":
|
|
raise RuntimeError(
|
|
"Found legacy-plaintext HL key; run migration script before production"
|
|
)
|
|
logger.warning("Reading LEGACY plaintext HL key — migrate ASAP")
|
|
return stored
|
|
try:
|
|
return _cipher().decrypt(stored[len(ENC_PREFIX):].encode("utf-8")).decode("utf-8")
|
|
except InvalidToken as exc:
|
|
raise RuntimeError("HL key decryption failed — wrong ENCRYPTION_KEY?") from exc
|